Hi,
I just found that there is a strange record in the maillog similar to this:
Nov 27 11:02:32 servera sendmail[11402]: gAR32VP11402: from=<abc@abc.com>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=MTA, relay=[1.2.3.4]
The "from" address and also the "relay IP" is...